Maestro VSX: kernel route table doesn't match SmartConsole VS route after policy

Ricardo_1806 — Wed, 26 Aug 2026 22:58:25 GMT

Hi all,

Running into something odd on a Maestro Security Group (R81.20, VSX with multiple Virtual Systems).

We added new static routes this week directly in the VS Topology/Routes tab in SmartConsole. Policy install completed successfully on all Security Group Members (confirmed with fw stat across all SGMs, correct policy name + timestamp).

However, when I run ip route get <dest> in Expert mode (inside the correct vsenv), the kernel returns a different next-hop/interface (a wrp Warp interface pointing elsewhere) than the one configured in the SmartConsole route table for that VS.

Has anyone run into a mismatch like this between the SmartConsole-configured VS route table and the actual kernel FIB after a policy install on Maestro? Trying to figure out if this is route propagation via the Virtual Switch overriding the manual static route, a per-SGM sync issue, or something that needs a manual push/refresh beyond "Install Policy." Any known SK or gotcha appreciated.

Thanks!

Re: Maestro VSX: kernel route table doesn't match SmartConsole VS route after policy

Dario_Perez — Wed, 26 Aug 2026 23:09:27 GMT

Run first the netstat -a to see if the route you need is there.

netstat -nr works at kernel level when interface is up, if the interface is down routes behind that interface wont be there.

on gclish use

show route destination

you route should be there.

if your interface is up, check the routing table to see if you don't have any other route that can hide which you defined.

topic Re: Maestro VSX: kernel route table doesn't match SmartConsole VS route after policy in Hyperscale Firewall (Maestro)

Maestro VSX: kernel route table doesn't match SmartConsole VS route after policy

Re: Maestro VSX: kernel route table doesn't match SmartConsole VS route after policy